From 26c758cf4870d834dfe4d20bb2ce76f701befd61 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Sat, 2 Mar 2019 17:18:39 +0000 Subject: [PATCH 1/1] suricata: Drop parsers I have never heard of Signed-off-by: Michael Tremer Signed-off-by: Stefan Schantl --- config/suricata/suricata.yaml | 34 ---------------------------------- 1 file changed, 34 deletions(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 84c4aa2a7e..8b4ab8c3b3 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -257,40 +257,6 @@ app-layer: double-decode-path: no double-decode-query: no - # Note: Modbus probe parser is minimalist due to the poor significant field - # Only Modbus message length (greater than Modbus header length) - # And Protocol ID (equal to 0) are checked in probing parser - # It is important to enable detection port and define Modbus port - # to avoid false positive - modbus: - # How many unreplied Modbus requests are considered a flood. - # If the limit is reached, app-layer-event:modbus.flooded; will match. - #request-flood: 500 - - enabled: no - detection-ports: - dp: 502 - # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it - # is recommended to keep the TCP connection opened with a remote device - # and not to open and close it for each MODBUS/TCP transaction. In that - # case, it is important to set the depth of the stream reassembling as - # unlimited (stream.reassembly.depth: 0) - - # Stream reassembly size for modbus. By default track it completely. - stream-depth: 0 - - # DNP3 - dnp3: - enabled: no - detection-ports: - dp: 20000 - - # SCADA EtherNet/IP and CIP protocol support - enip: - enabled: no - detection-ports: - dp: 44818 - sp: 44818 # Limit for the maximum number of asn1 frames to decode (default 256) asn1-max-frames: 256 -- 2.39.2